Greetings! On Sun, 2026-08-23 at 23:15 +0200, goeb wrote: > Might be a good idea to check for any .<package>.install > files > across the AUR.
Thank you, my own AURSCAN https://github.com/manticore-projects/aurscan missed this too. It only looked at the PKGBUILD, which is clean here — the payload is in the install scriptlet, and the only link between the two is a filename string in install=. makepkg never runs that file; pacman does (as root). The leading dot hides it from simple ls as well. I released AURSCAN v0.8 today, which resolves the referenced files and no longer calls a package clean when it has not read them. It also flags a dot-prefixed install=, the Tor fetch into /usr/local/bin, and the push back to aur.archlinux.org. Static rules, offline. Heuristic only, and calibrated against a small sample, so false positives are likely. Reports welcome. Best and cheers, Andreas
